bugThe nmh Mail Handling System - Bugs: bug #23168, post -sasl doesn't honour username...

 
 

bug #23168: post -sasl doesn't honour username in .netrc

Submitter:  Peter Maydell <pm215>
Submitted:  Sun 04 May 2008 06:03:38 PM UTC
   
 
Category:  Bug Severity:  3 - Normal
Priority:  * 5 - Normal Status:  Fixed
Assigned to:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 14 Apr 2013 03:00:35 PM UTC, comment #3: 

After further thought, I fixed this, commit 52a236230220232fd632b5aa88eb9bb31dba346e.  The existing behavior remains the default.  But by adding a "credentials" entry to your profile, you can select behavior that honours the username in the .netrc.  And, the .netrc filename can be any valid filename.  See the credentials entry in the mh-profile(5) man page for details.

David Levine <levine>
Group administrator
Mon 01 Apr 2013 02:49:09 AM UTC, comment #2: 

I'm closing this for two reasons:
1) The tricky issue that Peter mentioned of not requesting the username when there's no .netrc, and
2) inc, msgchk, send, and post all have -user switches.  It's so often necessary to use that if authentication is required, that it seems best just to rely on it for the login name.

David Levine <levine>
Group administrator
Mon 20 Jul 2009 02:15:13 AM UTC, comment #1: 

I am not sure if this issue is related: it seems nmh does not hornor not only .netrc but anything that mentions username.
See:

zhangweiwu@casablanca:~$ cat .netrc
cat: .netrc: No such file or directory
zhangweiwu@casablanca:~$ inc -sasl -saslmech login -snoop
<--- +OK VFEmail.net ready.
---> CAPA
<--- +OK
---> AUTH LOGIN
<--- + VXNlcm5hbWU6
Password (gildororonar@mail-on.us:mail.vfemail.net):
---> emhhbmd3ZWl3dQ==
<--- + UGFzc3dvcmQ6
---> bWFpbC52ZmVtYWlsLm5ldA==
<--- -ERR Authentication failed.
---> QUIT
<--- +OK Logging out
-ERR Authentication failed.
inc: -ERR Authentication failed.
zhangweiwu@casablanca:~$ echo emhhbmd3ZWl3dQ== | base64 -d; echo
zhangweiwu
zhangweiwu@casablanca:~$

So you can see pop prompts for password of <gildororonar@mail-on.us>, and when user entered a password, it then tell server the username of current user instead of <gildororonar@mail-on.us>. In short nmh lied to user. This happens, as you can see, even when there is no .netrc

Zhang Weiwu <zhangweiwu>
Sun 04 May 2008 06:03:38 PM UTC, original submission:  

If you have a .netrc with contents something like:
machine localhost login me password wombat

then
  post ~/draft -watch -sasl -snoop
incorrectly sends the server the local username rather than the username 'me' specified in the .netrc. It does correctly get the password out of the .netrc.

This is because ruserpass() (which reads the .netrc) is only called from sm_get_pass(); sm_get_user() just uses the results of sm_auth_sasl()'s call to getusername().

Fixing this could be a bit tricky because if you call ruserpass() and you don't have a .netrc then it will prompt for both username and password, so anybody using an auth method where local username is OK and no password is required will suddenly be presented with a username/password dialog. Some thought required here.


Peter Maydell <pm215>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by levine (Posted a comment)
  • -email is unavailable- added by zhangweiwu (would be glad to know if this project is still alive)
  • -email is unavailable- added by zhangweiwu (Posted a comment)
  • -email is unavailable- added by pm215 (Submitted the item)
  •  

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-04-14 levine StatusWont Fix Fixed
    2013-04-01 levine StatusNone Wont Fix
        Open/ClosedOpen Closed
    2009-07-20 zhangweiwu Carbon-Copy- Added -email is unavailable-
    2008-12-29 pm215 CategoryNone Bug

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code